granttap-mcp 0.8.34 → 0.8.36

package/README.md

@@ -4,16 +4,18 @@
 [![CI](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sergii-ziborov/granttap-mcp/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-GrantTap is a distributed Project control system for local coding agents.
+> **See what your coding agents are doing. Step in when they need you.**
 
-> See what your coding agents are doing. Step in when they need you.
+GrantTap connects local Claude Code and Codex work to a live control center on
+Mac, iPhone, iPad, and Apple Watch. See the Task and its latest activity, answer
+an approval or question with context, and continue the same goal as sessions or
+computers change. Cursor and Grok Build join the view where their local
+integrations support it.
 
-This repository is the canonical machine runtime: CLI, MCP server, provider
-hooks, local adapters, and TypeScript wire schemas. It connects the Mac,
-iPhone, iPad, and Apple Watch product surfaces to local agents, Project Mesh,
-Governance, auto-accept, and Engine-backed evidence. Agents and provider
-credentials stay on your computer. Native controller traffic is end-to-end
-encrypted.
+This repository supplies the local runtime: CLI, MCP server, provider hooks,
+adapters, and wire contracts. It powers Project Mesh, Governance, and observed
+usage while agents and provider credentials stay on your computer. Controller
+traffic is end-to-end encrypted.
 
 The MCP runtime, plugins, and CLI are open source under the MIT License.
 The Apple apps, Engine, relay, and website are separately licensed commercial
@@ -23,6 +25,28 @@ products or source. Their licenses do not change this repository's MIT grant.
 [Security model](SECURITY.md) ·
 [Relay source](https://github.com/sergii-ziborov/granttap-relay)
 
+## Account Mesh and devices
+
+The passkey Account Mesh is the person's relay space. It exists with zero
+computers and can contain many computers and Project Meshes. Create or join it
+from **Devices** in the iPhone, iPad, or Mac app, then use the same passkey in
+the MCP connection card to attach this computer. A previously linked computer
+reuses its machine identity; reconnecting does not create a duplicate. The
+local helper reports the Mac's user-assigned Computer Name and updates its
+account display name when that name changes. Device names are display labels,
+not routing keys: each Task keeps the computer route selected by its Mesh.
+
+Install the local helper separately from the Mac App Store app:
+
+```bash
+npm install -g granttap-mcp
+granttap setup
+```
+
+The Mac app can join the Account Mesh before the helper is present and links it
+when the installed helper becomes available. A one-time QR still provides direct
+device pairing without a passkey account.
+
 ## Mac, iPhone, iPad, and Apple Watch
 
 <p align="center">
@@ -36,11 +60,13 @@ products or source. Their licenses do not change this repository's MIT grant.
   <img src="docs/images/apple-watch-approval.png" width="180" alt="GrantTap approval on Apple Watch">
 </p>
 
+<p align="center"><em>GrantTap iPhone and Apple Watch screens with deterministic sample work; no private user tasks are shown.</em></p>
+
 ## Supported providers
 
-- Primary: Claude Code and Codex.
-- Beta: Cursor.
-- Experimental where available: Grok Build.
+- Claude Code and Codex: primary local control and continuation paths.
+- Cursor: Task visibility and supported local controls, with narrower coverage.
+- Grok Build: observable work where the installed runtime exposes it.
 
 GrantTap reports the depth each provider actually exposes. Visibility does not
 imply deterministic remote blocking or full mobile continuation.
@@ -147,7 +173,7 @@ computers. GrantTap builds a bounded Task Capsule from explicit task/git facts,
 requires local phone authorization, creates a separate target branch/worktree,
 starts the target execution, and returns a receipt bound to the exact capsule.
 Cursor uses the same provider-neutral schema and trusted caller attribution.
-Grok Build remains Experimental and observable where available, but does not
+Grok Build remains observable where available, but does not
 yet expose a trusted caller hook, so agent-authored scoped Mesh events are not
 offered for it. Unsupported remote-start paths fail closed instead of claiming
 parity.

package/apps/bridge/src/account-recovery/enroll.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadAccountLink, saveAccountLink } from "./link";
 
 const TOKEN = /^[A-Za-z0-9_-]{43}$/;
@@ -6,7 +6,8 @@ const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-
 
 /** Native Mac app authorizes this MCP with its account session over protected loopback. */
 export async function enrollMacAccount(accountToken: string, origin: string,
-  request: typeof fetch = fetch): Promise<{ accountId: string; machineId: string }> {
+  request: typeof fetch = fetch,
+  computerName: () => string = computerDisplayName): Promise<{ accountId: string; machineId: string }> {
   if (!TOKEN.test(accountToken) || new URL(origin).protocol !== "https:") {
     throw new Error("Invalid account authorization.");
   }
@@ -22,19 +23,29 @@ export async function enrollMacAccount(accountToken: string, origin: string,
     if (existing.accountId !== me.accountId) {
       throw new Error("This Mac is linked to a different account. Revoke it first.");
     }
-    const linked = await request(`${origin}/api/account/machines`, {
-      headers, signal: AbortSignal.timeout(8_000), redirect: "error",
+    const linked = await request(`${origin}/api/account/machine/identity`, {
+      headers: { authorization: `Bearer ${existing.machineToken}` },
+      signal: AbortSignal.timeout(8_000), redirect: "error",
     });
-    if (!linked.ok) throw new Error("Account computer list is unavailable.");
-    const list = await linked.json() as { machines?: Array<{ id?: string }> };
-    if (!Array.isArray(list.machines)) throw new Error("Invalid account computer list.");
-    if (list.machines.some(machine => machine.id === existing.machineId)) {
+    if (linked.status !== 401 && !linked.ok) throw new Error("Account machine is unavailable.");
+    if (linked.ok) {
+      const identity = await linked.json() as { accountId?: string; machineId?: string };
+      if (identity.accountId !== me.accountId || identity.machineId !== existing.machineId) {
+        throw new Error("Account machine identity changed unexpectedly.");
+      }
+      const renamed = await request(`${origin}/api/account/machine/self`, {
+        method: "PATCH", headers: { authorization: `Bearer ${existing.machineToken}`,
+          "content-type": "application/json" },
+        body: JSON.stringify({ name: computerName() }),
+        signal: AbortSignal.timeout(8_000), redirect: "error",
+      });
+      if (!renamed.ok) throw new Error("Account computer name could not be updated.");
       return { accountId: existing.accountId, machineId: existing.machineId };
     }
   }
   const registration = await request(`${origin}/api/account/machines`, {
     method: "POST", headers: { ...headers, "content-type": "application/json" },
-    body: JSON.stringify({ name: hostname().slice(0, 80) }),
+    body: JSON.stringify({ name: computerName() }),
     signal: AbortSignal.timeout(8_000), redirect: "error",
   });
   if (registration.status !== 201 && registration.status !== 200) {

package/apps/bridge/src/config/access/pairing.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { generateKeyPair, randomId } from "../../../../../packages/core/crypto";
 import type { PeerConfig } from "../../../../../packages/core/relay-client";
 import { configDir } from "../runtime/paths";
@@ -129,7 +129,7 @@ export function createPairing(relayUrl: string): {
     relayUrl,
     room,
     role: "machine",
-    deviceName: hostname(),
+    deviceName: computerDisplayName(),
     senderId: randomId(4),
     myPublicKey: machine.publicKey,
     mySecretKey: machine.secretKey,

package/apps/bridge/src/machine-load/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import type {
   MachineLoad,
   SessionsStatus,
@@ -78,7 +78,7 @@ export function buildMachineLoad(input: {
   ]);
   return {
     type: "machine.load",
-    machine: input.machine ?? hostname(),
+    machine: input.machine ?? computerDisplayName(),
     monitorCpuPercent: input.self.cpuPercent,
     monitorMemoryBytes: input.self.memoryBytes,
     agents: [...agents]

package/apps/bridge/src/monitor/support/heartbeat.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import type { RelayClient } from "../../../../../packages/core/relay-client";
 
 /**
@@ -20,7 +20,7 @@ export const HEARTBEAT_INTERVAL_MS = Number(
  */
 export async function publishHeartbeat(client: RelayClient): Promise<void> {
   await client.send(
-    { type: "machine.heartbeat", machine: hostname(), createdAt: Date.now() },
+    { type: "machine.heartbeat", machine: computerDisplayName(), createdAt: Date.now() },
     "phone",
     { ttlMs: HEARTBEAT_INTERVAL_MS * 3, reliable: false },
   );
@@ -38,7 +38,7 @@ export const HELD_HEARTBEAT_TTL_MS = 60_000;
 
 export async function publishHeldHeartbeat(client: RelayClient): Promise<void> {
   await client.send(
-    { type: "machine.heartbeat", machine: hostname(), createdAt: Date.now() },
+    { type: "machine.heartbeat", machine: computerDisplayName(), createdAt: Date.now() },
     "phone",
     { ttlMs: HELD_HEARTBEAT_TTL_MS, reliable: true },
   );

package/apps/bridge/src/monitor/support/runtime.ts

@@ -1,5 +1,5 @@
 import { refreshCodexHooks } from "../../codex-hook-trust";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { RelayClient } from "../../../../../packages/core/relay-client";
 import type { Payload, SessionInfo, SessionsStatus } from "../../../../../packages/protocol/schema";
 import { loadRuntimeConfig } from "../../config";
@@ -18,6 +18,7 @@ import { deriveObservedClaims } from "../../mesh/observed/claims";
 import { ingestRuntimeInvocations } from "../../engine/invocation/ingest";
 import { HEARTBEAT_INTERVAL_MS, publishHeartbeat } from "./heartbeat";
 import { confirmPendingController } from "../../pairing/controllers";
+import { recordControllerName } from "../../pairing/presence";
 import { startPublishLoop } from "./publish-loop";
 import { singleFlightPublisher } from "./single-flight";
 import { createMachineLoadPublisher } from "../../machine-load";
@@ -81,7 +82,7 @@ function monitorSnapshot(input: {
   const runtime = loadRuntimeConfig();
   return {
     type: "sessions.status",
-    machine: hostname(),
+    machine: computerDisplayName(),
     sessions: decorateSessions(sessions, subscriptions),
     history: includeHistory
       ? decorateSessions(boundedCatalogHistory(history(forceHistory), subscriptions), subscriptions)
@@ -218,6 +219,7 @@ export function startSessionMonitor(client: RelayClient): SessionMonitor {
   const off = client.onMessage(async (payload: Payload, peerPublicKey) => {
     if (payload.type === "hello" && payload.role === "phone") {
       confirmPendingController(client.room, peerPublicKey);
+      recordControllerName(peerPublicKey, payload.deviceName);
     }
     return handleMonitorMessage(client, payload, { leadership, subscriptions, publish, peerPublicKey });
   });

package/apps/bridge/src/pairing/presence.ts

@@ -1,10 +1,12 @@
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { configDir } from "../config/runtime/paths";
+import { writePrivateFile } from "../config/access/write-private";
 
 type PresenceState = {
   phoneLastSeenAt?: number;
   controllers?: Record<string, number>;
+  names?: Record<string, string>;
 };
 
 function presencePath(): string {
@@ -31,6 +33,25 @@ export function readControllerLastSeenAt(peerPublicKey: string): number | null {
   return typeof at === "number" && Number.isFinite(at) ? at : null;
 }
 
+export function readControllerName(peerPublicKey: string): string | null {
+  const name = readPresence().names?.[peerPublicKey];
+  return typeof name === "string" && name.length > 0 && name.length <= 80
+    && !/^(phone|machine|iphone|ipad)$/i.test(name) ? name : null;
+}
+
+/** A controller chooses its own visible label; never infer it from a pairing role. */
+export function recordControllerName(peerPublicKey: string, value: string): boolean {
+  const name = value.trim();
+  if (!/^[A-Za-z0-9+/]{43}=$/.test(peerPublicKey)
+    || !name || name.length > 80 || /[\x00-\x1f\x7f]/.test(name)
+    || /^(phone|machine|iphone|ipad)$/i.test(name)) return false;
+  const previous = readPresence();
+  const names = { ...previous.names, [peerPublicKey]: name };
+  const bounded = Object.fromEntries(Object.entries(names).slice(-32));
+  writePrivateFile(presencePath(), JSON.stringify({ ...previous, names: bounded }));
+  return true;
+}
+
 export function hasControllerPresence(): boolean {
   return Object.keys(readPresence().controllers ?? {}).length > 0;
 }

package/apps/bridge/src/reply/process/index.ts

@@ -93,7 +93,6 @@ export function runProcess(
       return;
     }
     const untrack = key ? track(key, child) : () => {};
-    if (stdin != null) child.stdin?.end(stdin);
     let stdout = "";
     let stderr = "";
     let done = false;
@@ -134,5 +133,13 @@ export function runProcess(
         }` });
       }
     });
+    if (stdin != null) {
+      child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
+        // A CLI can finish with a valid result before it reads the whole prompt.
+        // Its closed pipe must not become an uncaught exception in the bridge.
+        if (error.code !== "EPIPE") finish({ ok: false, error: `${command}: ${error.message}` });
+      });
+      child.stdin?.end(stdin);
+    }
   });
 }

package/apps/mcp/src/connection-center/README.md

@@ -23,11 +23,12 @@ checks parent messages, refreshes pending pairing while visible, and keeps
 copyable transfer material out of model-visible text and persistent UI storage.
 Non-UI clients can still use the tools and display the returned QR image.
 
-The connection card itself does not log in to an account. The Codex-owned
-plugin management page is not this UI. The optional Mac passkey choice lives
-in the browser authorization page for the loopback HTTP MCP server. It grants
-the coding app an MCP token, without creating a phone pairing or changing the
-local provider runtime.
+Connect with passkey on the card creates a short-lived, authenticated website
+request. A fresh passkey assertion on granttap.com links this Mac to the user's
+account; the site returns a machine token only to the local MCP watcher, which
+saves it privately. The QR pairing room and provider runtime remain unchanged.
+The separate coding-app OAuth page can also use passkey to authorize that MCP
+client. The Codex-owned plugin management page is not this card.
 
 Tests in `tests/` exercise isolated keys, a loopback encrypted phone connection,
 expiry, non-mutating status, and actual DOM button/host-message behavior.

package/apps/mcp/src/connection-center/bridge.js

@@ -72,6 +72,7 @@ async function call(name, args = {}) {
       : await request("tools/call", { name, arguments: args });
     if (result?.isError) message("Could not complete the request. Refresh status and check the relay before retrying.");
     else { render(result); message("Status updated."); }
+    return result;
   } catch {
     message("No successful response. Refresh status before retrying; pairing may already have changed.");
   } finally {

package/apps/mcp/src/connection-center/passkey.ts

@@ -0,0 +1,27 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { buildConnectSnapshot } from "../oauth/session/connect-snapshot";
+import { publishConnectRequestRetry, watchConnectDecision, websiteOrigin } from "../oauth/consent/website-session";
+
+const REQUEST_LIFETIME_MS = 15 * 60_000;
+let pending: { url: string; expiresAt: number } | null = null;
+
+/** Start a browser passkey ceremony for this Mac. No account credential enters MCP output. */
+export async function startPasskeyAccountLink(): Promise<string> {
+  if (pending && pending.expiresAt > Date.now()) return pending.url;
+  const origin = websiteOrigin();
+  if (!origin) throw new Error("GrantTap account service is unavailable.");
+  const id = randomUUID();
+  const secret = randomBytes(32).toString("base64url");
+  const snapshot = () => ({ ...buildConnectSnapshot("GrantTap MCP"), purpose: "account-link" as const });
+  if (!await publishConnectRequestRetry(origin, id, snapshot(), 3, secret)) {
+    throw new Error("GrantTap account service did not accept the connection request.");
+  }
+  watchConnectDecision(origin, id, snapshot, (approved, method) => {
+    if (!approved || method !== "passkey") throw new Error("Use the account passkey to link this Mac.");
+    pending = null;
+    return { redirectUrl: `${origin}/account` };
+  }, { requestSecret: secret });
+  const url = `${origin}/connect#request=${id}`;
+  pending = { url, expiresAt: Date.now() + REQUEST_LIFETIME_MS };
+  return url;
+}

package/apps/mcp/src/connection-center/state.ts

@@ -1,11 +1,12 @@
 import { z } from "zod";
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadConfig } from "../../../bridge/src/config";
 import { isMachineConfigured, listPairedPhones, readOnlyMachineConfigPath } from "../status/pairing-status";
 import { inspectProviderStatusSnapshot } from "../status/provider-status";
 import { packageVersion } from "../status/package-version";
 import { connectionRuntimeStatus } from "../mcp-tools/connect/relay";
 import { beginEnrollment, cancelEnrollment, enrollmentIsOpen } from "./enrollment";
+import { loadAccountLink } from "../../../bridge/src/account-recovery/link";
 
 export const connectionOutput = {
   status: z.enum(["disconnected", "paired", "pairing", "expired", "connected"]),
@@ -23,6 +24,7 @@ export const connectionOutput = {
   expiresInMinutes: z.number().int().positive().nullable(),
   providers: z.array(z.object({ id: z.string(), status: z.string(), detail: z.string() })),
   roomPrefix: z.string(),
+  accountLinkSaved: z.boolean(),
 };
 
 export type PendingCode = {
@@ -66,7 +68,7 @@ export class ConnectionState {
     return {
       structuredContent: {
         status,
-        computer: hostname(),
+        computer: computerDisplayName(),
         version: packageVersion(),
         relay: config ? new URL(config.relayUrl).host : "",
         relayStatus: runtime.relayStatus,
@@ -76,6 +78,7 @@ export class ConnectionState {
         expiresInMinutes: code ? Math.max(1, Math.ceil((code.expiresAt - now) / 60_000)) : null,
         providers: inspectProviderStatusSnapshot().providers.map(({ id, status, detail }) => ({ id, status, detail })),
         roomPrefix: config?.room ? config.room.slice(0, 8) : "",
+        accountLinkSaved: loadAccountLink() !== null,
       },
       _meta: { granttap: code ? { pairingUri: code.pairingUri, qrDataUrl: code.qrDataUrl } : {} },
     };

package/apps/mcp/src/connection-center/view.js

@@ -21,6 +21,16 @@ function render(value) {
   current = state;
   clearCode();
   const meta = result._meta?.granttap ?? {};
+  const passkeyUrl = typeof meta.passkeyUrl === "string" && /^https:\/\/granttap\.com\/connect#request=[0-9a-f-]{36}$/i.test(meta.passkeyUrl)
+    ? meta.passkeyUrl : "";
+  $("passkey-link").classList.toggle("hidden", !passkeyUrl || state.accountLinkSaved === true);
+  if (passkeyUrl) $("passkey-link").setAttribute("href", passkeyUrl);
+  else $("passkey-link").removeAttribute("href");
+  $("account-status").textContent = state.accountLinkSaved === true
+    ? "Saved account link on this Mac. Current server access is checked when it is used."
+    : "No account linked on this Mac. A passkey can link it without changing the QR pairing.";
+  $("passkey").textContent = state.accountLinkSaved === true
+    ? "Reauthorize with passkey" : "Connect with passkey";
   const labels = {
     disconnected: ["Not paired", "Add a device", "Tap Add a device. Scan the QR in GrantTap on iPhone, iPad, or Android."],
     pairing: ["Waiting for a device", "Scan this QR", "Keep this card open. The QR is only here — not in chat."],
@@ -91,6 +101,7 @@ $("connect").addEventListener("click", () => {
   call("connect");
 });
 $("refresh").addEventListener("click", () => call("connection_status"));
+$("passkey").addEventListener("click", () => call("connect_with_passkey"));
 $("reconnect").addEventListener("click", () => {
   pendingMode = "reconnect";
   $("confirm-copy").textContent = "Reconnect shows a new QR for the existing controller device in this room.";

package/apps/mcp/src/connection-center/widget.html

@@ -27,7 +27,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
 </svg>
 </div><div><div class="title">GrantTap</div><div class="status"><span class="dot"></span><span id="status">Checking connection…</span></div></div></header>
   <section class="body">
-    <div class="copy"><h2 id="heading">Add a device</h2><p id="detail">Scan the QR in GrantTap on iPhone, iPad, or Android. It appears here as soon as pairing starts.</p><ul class="phones" id="phones"></ul><p class="empty" id="phones-empty">No saved pairing on this Mac yet.</p><div class="actions"><button class="primary" id="connect">Add a device</button><button id="reconnect">Reconnect</button><button id="new-qr" class="hidden">Create a new QR</button><button id="refresh">Refresh status</button><button id="copy" class="hidden">Copy pairing link</button></div><div class="message small" id="message" role="status"></div></div>
+    <div class="copy"><h2 id="heading">Add a device</h2><p id="detail">Scan the QR in GrantTap on iPhone, iPad, or Android. It appears here as soon as pairing starts.</p><ul class="phones" id="phones"></ul><p class="empty" id="phones-empty">No saved pairing on this Mac yet.</p><div class="actions"><button class="primary" id="connect">Add a device</button><button id="reconnect">Reconnect</button><button id="new-qr" class="hidden">Create a new QR</button><button id="refresh">Refresh status</button><button id="copy" class="hidden">Copy pairing link</button></div><p id="account-status" class="small">Checking account link…</p><div class="actions"><button id="passkey">Connect with passkey</button><a id="passkey-link" class="hidden" target="_blank" rel="noopener noreferrer">Continue on granttap.com</a></div><div class="message small" id="message" role="status"></div></div>
     <img id="qr" class="hidden" alt="GrantTap pairing QR" />
   </section>
   <p id="expiry" class="small" aria-live="polite"></p>
@@ -36,9 +36,8 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <dt>Relay observed by this MCP</dt><dd id="relay">Not checked</dd>
     <dt>Last encrypted message from iPhone</dt><dd id="phone">Not observed</dd></dl>
     <h3>Provider readiness</h3><ul id="providers"></ul>
-    <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
-    Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.23</code> and <code>granttap setup</code> locally.
+    <p>QR pairs a phone directly. A passkey links this Mac to your GrantTap account so your signed-in phone can discover its computers. Provider sign-in is separate.</p>
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.36</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/desktop/load/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import {
   sampleAgentProcesses, type AgentProcessLoad,
 } from "../../../../bridge/src/machine-load/host/process-sampler";
@@ -12,7 +12,7 @@ export async function desktopMachineLoad(
   return {
     operation: "desktop.machine_load" as const,
     source: "process_sample" as const,
-    computer: hostname(),
+    computer: computerDisplayName(),
     observed_at: now(),
     agents: Object.entries(processes)
       .filter(([agent]) => agent.length > 0)

package/apps/mcp/src/desktop/pairing/index.ts

@@ -1,4 +1,4 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { loadConfig } from "../../../../bridge/src/config";
 import { reloadPairingHelper } from "../../../../bridge/src/install";
 import { createOneTimePairing, DEFAULT_RELAY, PAIRING_CODE_TTL_MINUTES } from "../../../../bridge/src/pairing";
@@ -37,7 +37,7 @@ export class DesktopControllerEnrollment {
 
   snapshot(now = Date.now()): DesktopControllerCode {
     const result: DesktopControllerCode = {
-      operation: "desktop.controller_enrollment", status: "idle", computer: hostname(),
+      operation: "desktop.controller_enrollment", status: "idle", computer: computerDisplayName(),
     };
     if (!this.pending) return result;
     if (!isMachineConfigured()) { this.pending = null; return result; }
@@ -77,7 +77,8 @@ export class DesktopControllerEnrollment {
       this.onPairingChanged();
       return this.snapshot();
     } catch {
-      return { operation: "desktop.controller_enrollment", status: "unavailable", computer: hostname() };
+      return { operation: "desktop.controller_enrollment", status: "unavailable",
+        computer: computerDisplayName() };
     }
   }
 }

package/apps/mcp/src/mcp-tools/connect/index.ts

@@ -7,6 +7,7 @@ import { isMachineConfigured } from "../../status/pairing-status";
 import { ConnectionState, connectionOutput } from "../../connection-center/state";
 import { CONNECTION_WIDGET_URI } from "./widget";
 import { resetRelay, relay } from "./relay";
+import { startPasskeyAccountLink } from "../../connection-center/passkey";
 
 const widgetMeta = {
   ui: { resourceUri: CONNECTION_WIDGET_URI, visibility: ["model", "app"] },
@@ -39,6 +40,24 @@ export function registerConnectTool(server: McpServer): void {
     annotations: { ...changes, readOnlyHint: true, idempotentHint: true },
     _meta: widgetMeta,
   }, async () => connectionResult(state));
+  server.registerTool("connect_with_passkey", {
+    title: "Link this Mac to a GrantTap account",
+    description: "Open a short-lived GrantTap account passkey request for this Mac. The passkey is entered only on granttap.com; existing QR pairings remain unchanged.",
+    inputSchema: {},
+    outputSchema: connectionOutput,
+    annotations: changes,
+    _meta: widgetMeta,
+  }, async () => {
+    try {
+      const passkeyUrl = await startPasskeyAccountLink();
+      const result = connectionResult(state);
+      const meta = result._meta?.granttap;
+      const granttap = meta && typeof meta === "object" ? meta : {};
+      return { ...result, _meta: { granttap: { ...granttap, passkeyUrl } } };
+    } catch {
+      return { isError: true, content: [{ type: "text", text: "GrantTap could not start passkey linking. Check the account service and try again." }] };
+    }
+  });
   server.registerTool(
     "connect",
     {

package/apps/mcp/src/mcp-tools/connect/widget.ts

@@ -1,6 +1,6 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v3.html";
+export const CONNECTION_WIDGET_URI = "ui://granttap/connection/v4.html";
 
 import { readFileSync } from "node:fs";
 
@@ -13,7 +13,7 @@ export function registerConnectionWidget(server: McpServer): void {
     CONNECTION_WIDGET_URI,
     {
       title: "GrantTap connection center",
-      description: "GrantTap card: devices in this pairing room, Add a device, and the QR on this card only.",
+      description: "GrantTap card: QR device pairing, Mac account passkey linking, and connection status.",
       mimeType: "text/html;profile=mcp-app",
     },
     async (uri) => ({
@@ -23,7 +23,7 @@ export function registerConnectionWidget(server: McpServer): void {
         text: html,
         _meta: {
           ui: { prefersBorder: true, permissions: { clipboardWrite: {} }, csp: { connectDomains: [], resourceDomains: [] } },
-          "openai/widgetDescription": "List devices in this pairing room and add one with a QR that stays on this card.",
+          "openai/widgetDescription": "Pair a device by QR or link this Mac to your account with passkey.",
           "openai/widgetPrefersBorder": true,
         },
       }],

package/apps/mcp/src/oauth/session/connect-snapshot.ts

@@ -2,7 +2,7 @@ import { codexHooksReady } from "../../../../bridge/src/codex-hook-trust";
 /**
  * Public consent snapshot for granttap.com. No pairing keys, tokens, or codes.
  */
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../../packages/core/computer-name";
 import { inspectAgentIntegrations } from "../../../../bridge/src/install";
 import { loadConfig } from "../../../../bridge/src/config";
 import { computerId } from "../../../../bridge/src/mesh/identity/computer";
@@ -49,7 +49,7 @@ export function buildConnectSnapshot(clientName?: string): ConnectSnapshot {
   const runtime = connectionRuntimeStatus(room || undefined);
   return {
     clientName: publicClientName(clientName),
-    computerName: hostname(),
+    computerName: computerDisplayName(),
     paired,
     passkeyCapable: true,
     machineId: loadAccountLink()?.machineId,
@@ -70,7 +70,7 @@ export function buildConnectSnapshot(clientName?: string): ConnectSnapshot {
 
 /** Computers and open tasks only. No transcripts, keys, or room ids. */
 export function publicMeshSummary(): ConnectMesh {
-  const thisComputer = hostname().trim().slice(0, 80) || "This Mac";
+  const thisComputer = computerDisplayName();
   try {
     const store = localMeshStore();
     const names = new Set<string>([thisComputer, computerId().slice(0, 80)]);

package/apps/mcp/src/status/desktop-status.ts

@@ -1,8 +1,9 @@
-import { hostname } from "node:os";
+import { computerDisplayName } from "../../../../packages/core/computer-name";
 import { loadConfig } from "../../../bridge/src/config";
 import { connectionRuntimeStatus } from "../mcp-tools/connect/relay";
 import { packageVersion } from "./package-version";
 import { computerId } from "../../../bridge/src/mesh/identity/computer";
+import { loadAccountLink } from "../../../bridge/src/account-recovery/link";
 import {
   isMachineConfigured, listPairedPhones, phoneReachability, readOnlyMachineConfigPath,
 } from "./pairing-status";
@@ -18,8 +19,9 @@ export function desktopStatusSnapshot(desktopEngineSocket?: string) {
     schema: "granttap.desktop-status.v1" as const,
     ok: true,
     service: "granttap-mcp" as const,
-    computer: hostname(),
+    computer: computerDisplayName(),
     endpointId: computerId(),
+    accountLinkSaved: loadAccountLink() !== null,
     version: packageVersion(),
     paired: configured,
     phoneReachability: phoneReachability(phones),

package/apps/mcp/src/status/pairing-status.ts

@@ -3,7 +3,8 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { loadConfig } from "../../../bridge/src/config";
-import { hasControllerPresence, readControllerLastSeenAt, readPhoneLastSeenAt } from "../../../bridge/src/pairing/presence";
+import { hasControllerPresence, readControllerLastSeenAt, readControllerName,
+  readPhoneLastSeenAt } from "../../../bridge/src/pairing/presence";
 import { controllerPeerGate } from "../../../bridge/src/pairing/controllers";
 
 export type PairedPhone = {
@@ -59,14 +60,15 @@ export function listPairedPhones(phoneLastSeenAt: number | null = null, now = Da
     value != null && (best == null || value > best) ? value : best
   ), null);
   const seen = lastSeenAt != null && now - lastSeenAt < 60_000;
-  const primary: PairedPhone = { name, status: seen ? "seen" : "paired", lastSeenAt };
+  const primary: PairedPhone = { name: readControllerName(machine.peerPublicKey) ?? name,
+    status: seen ? "seen" : "paired", lastSeenAt };
   const allowed = controllerPeerGate(machine);
   const additional = (machine.extraPeerPublicKeys ?? [])
     .filter((key) => key && key !== machine.peerPublicKey && allowed(key))
     .map((key, index): PairedPhone => {
       const at = readControllerLastSeenAt(key);
       const suffix = createHash("sha256").update(key).digest("hex").slice(0, 6);
-      return { name: `Controller ${index + 2} · ${suffix}`,
+      return { name: readControllerName(key) ?? `Controller ${index + 2} · ${suffix}`,
         status: at != null && now - at < 60_000 ? "seen" : "paired", lastSeenAt: at };
     });
   return [primary, ...additional];

package/cursor-plugin/README.md

@@ -10,7 +10,7 @@ keeps each phone response tied to the exact originating chat and prompt.
 Install the supported CLI on this computer, then run:
 
 ```bash
-npm install -g granttap-mcp@0.8.34
+npm install -g granttap-mcp@0.8.36
 granttap setup
 granttap status
 ```

package/cursor-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "-e",
-        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.34\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
+        "\"use strict\";\n\n// Cursor may start this MCP from any cwd. Execute JavaScript entry points with\n// Node itself: Windows batch shims require shell quoting that differs by host.\nconst { spawn } = require(\"node:child_process\");\nconst { existsSync } = require(\"node:fs\");\nconst { delimiter, dirname, join } = require(\"node:path\");\n\nconst PACKAGE = \"granttap-mcp@0.8.36\";\nconst dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === \"1\";\nconst platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM\n  ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;\nconst nodeRoot = dryRun && process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT\n  ? process.env.GRANTTAP_BOOTSTRAP_NODE_ROOT : dirname(process.execPath);\nconst pathRoots = (process.env.PATH || \"\").split(delimiter).filter(Boolean);\nconst appData = process.env.APPDATA;\nconst roots = [nodeRoot, ...pathRoots, ...(appData ? [join(appData, \"npm\")] : [])];\nconst first = (paths) => paths.find((path) => existsSync(path));\n\nfunction launch() {\n  if (platform !== \"win32\") {\n    const installed = first(roots.map((root) => join(root, \"granttap-mcp\")));\n    if (installed) return { command: installed, args: [] };\n    const npx = first(roots.map((root) => join(root, \"npx\"))) || \"npx\";\n    return { command: npx, args: [\"-y\", PACKAGE] };\n  }\n  const installed = first(roots.map((root) =>\n    join(root, \"node_modules\", \"granttap-mcp\", \"bin\", \"granttap-mcp.mjs\")));\n  if (installed) return { command: process.execPath, args: [installed] };\n  const npx = first(roots.map((root) =>\n    join(root, \"node_modules\", \"npm\", \"bin\", \"npx-cli.js\")));\n  if (npx) return { command: process.execPath, args: [npx, \"-y\", PACKAGE] };\n  throw new Error(\"Node.js/npm 20+ is required on this Windows device. Install npm and retry GrantTap.\");\n}\n\nlet target;\ntry { target = launch(); }\ncatch (error) {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n}\n\nif (dryRun) {\n  process.stdout.write(JSON.stringify(target));\n  process.exit(0);\n}\n\nconst child = spawn(target.command, target.args, { stdio: \"inherit\", windowsHide: true });\nchild.on(\"error\", (error) => {\n  process.stderr.write(`[granttap] ${error.message}\\n`);\n  process.exit(1);\n});\nchild.on(\"exit\", (code, signal) => {\n  if (signal && platform !== \"win32\") {\n    try { process.kill(process.pid, signal); } catch { process.exit(code ?? 1); }\n    return;\n  }\n  process.exit(code ?? 1);\n});\n"
       ]
     }
   }

package/cursor-plugin/stdio-bootstrap.cjs

@@ -7,7 +7,7 @@ const { spawn } = require("node:child_process");
 const { existsSync } = require("node:fs");
 const { delimiter, dirname, join } = require("node:path");
 
-const PACKAGE = "granttap-mcp@0.8.34";
+const PACKAGE = "granttap-mcp@0.8.36";
 const dryRun = process.env.GRANTTAP_BOOTSTRAP_DRY_RUN === "1";
 const platform = dryRun && process.env.GRANTTAP_BOOTSTRAP_PLATFORM
   ? process.env.GRANTTAP_BOOTSTRAP_PLATFORM : process.platform;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.34",
+  "version": "0.8.36",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {

package/packages/core/computer-name.ts

@@ -0,0 +1,31 @@
+import { execFileSync } from "node:child_process";
+import { hostname } from "node:os";
+
+type NameSources = {
+  platform?: NodeJS.Platform;
+  host?: string;
+  override?: string;
+  macName?: () => string;
+};
+
+function usableName(value: string | undefined): string | null {
+  const name = value?.trim();
+  return name && name.length <= 80 && !/[\x00-\x1f\x7f]/.test(name) ? name : null;
+}
+
+/** User-visible computer name; network hostname remains only a fallback. */
+export function computerDisplayName(sources: NameSources = {}): string {
+  const override = usableName(sources.override ?? process.env.GRANTTAP_COMPUTER_NAME);
+  if (override) return override;
+  if ((sources.platform ?? process.platform) === "darwin") {
+    try {
+      const macName = sources.macName ?? (() => execFileSync(
+        "/usr/sbin/scutil", ["--get", "ComputerName"],
+        { encoding: "utf8", timeout: 2_000, maxBuffer: 4_096 },
+      ));
+      const name = usableName(macName());
+      if (name) return name;
+    } catch { /* Computer Name may be unset; preserve the network fallback. */ }
+  }
+  return usableName(sources.host ?? hostname()) ?? "Computer";
+}